Password Crack-Time Estimator

Yes. The analysis runs entirely in your browser using the open-source zxcvbn library — your password is never transmitted, logged, or stored, and you can verify that in your browser's network tab. If you'd still rather not, test a password with the same structure and length instead.

We use zxcvbn, the estimator developed at Dropbox. It doesn't just count characters — it recognises dictionary words, names, dates, keyboard walks, and common substitutions, then estimates the guesses needed and divides by realistic attacker speeds, from a rate-limited website (100 guesses per hour) to an offline attack on a leaked database (10 billion per second).

It depends on how a service stores your password. If it's hashed with a slow algorithm like bcrypt, attackers manage thousands of guesses per second. If a site stored it with a fast hash like MD5 — or in plain text — the same password falls billions of times faster. You can't control that, which is why a password that survives the worst case is the goal.

Make it longer — length beats complexity. A four-word random passphrase or a 16+ character generated password beats any clever 8-character substitution. Use our free Password Generator to create one, never reuse passwords across accounts, and turn on two-factor authentication where offered.